Repository
mwiede/jsch
Scanned on Jun 5, 2026
Risk score/ 100
High risk
Summary
JSch library has critical post-quantum cryptography vulnerabilities with 30 broken algorithm implementations and 165 quantum-vulnerable cryptographic primitives. The codebase extensively uses RSA, DSA, ECDSA, and legacy ciphers (3DES, Blowfish) that will be completely broken by quantum computers, creating significant long-term security and compliance risks. Immediate migration planning to NIST-approved post-quantum algorithms is essential for regulatory compliance and future-proofing.
30
165
5
0
Top findings
- Critical3DES / TripleDES
examples/ScpToNoneCipher.java:50
- CriticalRSA key ≤ 2048 bits
src/main/java/com/jcraft/jsch/AgentProxy.java:128
- CriticalRSA key ≤ 2048 bits
src/main/java/com/jcraft/jsch/ChannelAgentForwarding.java:210
- CriticalRSA key ≤ 2048 bits
examples/KeyGenOpenSSHv1.java:14
- Critical3DES / TripleDES
examples/AES.java:44
+ 195 more findings in the full report
Scan your own repository
Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.